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Abstract 

This paper shows determining the secrecy capacity of a unicast network with uniform wiretap sets is at least 
as difficult as the fc-unicast problem. In particular, we show that a general fc-unicast problem can be reduced to the 
problem of finding the secrecy capacity of a corresponding single unicast network with uniform link capacities and 
one arbitrary wiretap link. 

I. Introduction 

The secure network coding problem, introduced by Cai and Yeung [1], concerns information theoretically secure 
communication over a network where an unknown subset of network links may be wiretapped. A secure code ensures 
that the wiretapper obtains no information about the secure message being communicated. The secrecy capacity of 
a network, with respect to a given collection of possible wiretap sets, is the maximum rate of communication such 
that for any one of the wiretap sets the secrecy constraints are satisfied. Types of secrecy constraints studied in the 
literature include perfect secrecy, strong secrecy and weak secrecy. 

This paper considers the problem of finding the secrecy capacity of a network when we allow network nodes 
in addition to the source to generate independent randomness. We show that a general fc-unicast problem can be 
reduced to a corresponding single unicast secrecy capacity problem with uniform link capacities where any single 
link can be wiretapped. This implies that determining the secrecy capacity, even in the simple case of a single 
unicast, uniform link capacities and unrestricted wiretap sets where any single link can be wiretapped, is at least as 
difficult as the long standing open problem of determining the capacity region of multiple-unicast network coding, 
which is not presently known to be in P, NP or undecidable [2]. In contrast, under the assumption that only the 
source can generate randomness, link capacities are uniform and up to z arbitrary links can be wiretapped, Cai 
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and Yeung [1] showed that the secrecy capacity is given by the cut-set bound and linear codes suffice to achieve 
capacity. The secure network coding problem with restricted wiretap sets and/or non-uniform link capacities has 
been considered by Cui et al. [3], who studied achievable coding schemes, and by Chan and Grant [4], who showed 
that determining multicast secrecy capacity with restricted (non-uniform) wiretap sets is at least as difficult as 
determining capacity for multiple-unicast network coding. Our reduction follows the same core ideas appearing 
in [4] with two differences. First, by introducing the idea of key cancellation and replacement at intermediate 
nodes, our construction does not need to impose restrictions on which links can be wiretapped. Secondly, unlike the 
reduction in [4] which involves multiple terminals, ours only needs a single destination. Therefore, our construction 
shows that even a single secure unicast in the uniform setting (equal capacity links where any one of which can 
be wiretapped) is as difficult as a k-unicast problem. 

II. Model 

A network is represented by a directed graph Q = (V, £), where V is the set of vertices which represent nodes, 
and £ is the set of edges that represent links. We assume links have equal capacity and there may be multiple 
links between a pair of nodes. There is a source node S € V and a destination node DeV. The source wants 
to communicate a message M, uniformly drawn from a finite alphabet set S n , to the destination using a code 
with length or duration n. Then the rate of the code is rT 1 log |«S n |. For the network coding problem, we say that 
a communication rate R is feasible if there exists a sequence of length-n codes such that |<S„| = 2 nR and the 
probability of decoding error tends to as n — > oo. 

For the secure network coding problem, we specify additionally a collection A of wiretap link sets, i.e., A is 
a collection of subsets of £ such that an eavesdropper can wiretap any one set in A. We consider three kinds of 
secrecy constraints: the requirement, for all A £ A, that 



corresponds to perfect secrecy, that 



corresponds to strong secrecy, and that 



I(M;X n (A)) =0 (1) 

I(M;X n (A)) -> as n ^ oo (2) 
I(M;X n (A)) 

-± — - -> as n -> oo (3) 

n 

corresponds to weak secrecy, where X{A) = {X(a, b) : (a,b) € A}, and X(a,b) is the signal transmitted on the 
link (a, b). We say a secrecy rate R is feasible if the communication rate R is feasible and the prescribed secrecy 
condition is satisfied. The secrecy capacity of the network is defined as the supremum of all feasible secrecy rates. 

III. Main Result 

Theorem 1. Given any K-unicast problem with source-destination pairs {(Si,Ti), i = 1,...,K} of unit rate, 
the corresponding secure communication problem in Figure 1 with unit capacity links, any one of which can be 
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wiretapped, has secrecy capacity K (under perfect, strong or weak secrecy requirements) if and only if the K-unicast 
problem is feasible. 

Proof: "=>". Suppose a secrecy rate of K is achieved by a code with length n. Let M be the source input 
message, then H(M) — Kn. Because there is no shared randomness between different nodes, M is independent 
with {d?, /£, k = I, ...,K}. Hence 

H(M\d?,f?,...,fZ)=Kn. (4) 

By the chain rule, 

H(M|c?, d?, / 2 ", ...,/£) + H(c?|d?, / 2 ", f n K ) = H(M, c?K, / 2 ", /£) > ff(M|d?, .... /£). 

So 

(M|c?, d?, / 2 ", /£) > ff(M|d?, / 2 ", /£) - H(c?|d?, / 2 ", /£) > (K - l)n, (5) 
where the last inequality holds because of (4) and _ff (c"|d™, / 2 l , /£) < H(c™) < n. Similarly, 

(M|c?, <, / 2 ", /£) < H(M\c?,c%, fS, .... /£, ej, .... e£) + H(eJ, .... e£|c?, <, / 2 ", /£) 

< ne„ + ff(e2, .., efclc?, d?, f 2 n , .., /£) (6) 

< ne„ + (if - l)n, (7) 

where e„ — »■ as n — »■ oo and (6) is due to the cut set {c™, dj , / 2 l , /]£■} from 5 to £) and Fano's inequality. 
Hence it follows 

> H(M|d?, / 2 ", .., /£) - tf(M|c?, d?, / 2 n , /£) (8) 
>n-ne„, (9) 
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where (8) holds because of (5), and (9) follows from (4) and (7). Also notice that 

ff(M|c?, d?, / 2 ", ft) > H(M\<%, / 2 ", /£) - H(d?|c?, / 2 ", /£), (10) 

where 

(M|c?, /£) - H(M|c?) >Kn- nS n , (11) 

with 5 n — > as n — > 0. Here the first equality holds because {M, c™} is independent with {/", i = 1,...,K} 
and the second inequality holds due to the weak secrecy constraint. Note that all arguments extend naturally to the 
cases of strong and perfect secrecy because they are even stronger conditions. Therefore by (7), (10) and (11) we 
have 

ff(d?)>ff(d?|cr, #,...,/£) 

> H(M\c n u SI) H(M\C?, d?, / 2 ", f n K ) 

>n — ne n — n5 n . (12) 

Furthermore, by the independency between the sets of {M, c™, d™} and {/", i = 1, if} we also have 

(M|c?, d?, / 2 ", /£) = ff(M|c?, d?) 

. According to (5) and (7), it is bounded by 

(if - l)n < H(M\c^, d") < ne„ + (K - l)n. (13) 

Now consider the joint entropy of M, d™ , c" and expand it in two ways 

H(M, d™, c?) = H(c™\M, d") + ff(M|d?) + (d?) 

= #(M|c^d?) + if(d?|c?) + if(c?) < (A + l)n + ne„, 

where the last inequality holds because of (13) and if(d™|c") < n, i?(c") < n. Therefore 

#(c"|M, d") < (X + l)n + ne n - (M |d?) - £T(d?) < 2ne„ + n<5„, (14) 

where (12) and i?(M|d") = Kn (because M and d™ are independent by construction) are used to establish the 
inequality. And so by observing the Markov chain (M, d") — > (M, 6") — > c™, it follows 

H(c?|M,6J) = iJ(c"|M,b",d") < if (c™|M, d") < 2ne n + nc5„. (15) 

Then consider the joint entropy of M, 6™, c" and expand it in two ways 

H(M, VI, c?) - H(6?|M, c?) + ff(M|c?) + Jf (c?) 

= if (c?|M, 6?) + H(M|6?) + ff(6?) < (A - + l)n + 2ne„ + nS n , 
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where the last inequality holds due to (15) and iJ(M|b") = Kn, H(b™) < n. Therefore by (9) and the weak 
secrecy constraint £f(M|c") > Kn — nS n , we have 

H(b?\M, c?) < (K + l)n + 2ne„ + nS n - H{M\c^) - H(c^) < 3ne„ + 2nd n . (16) 

So 

i?(b"|M,d") < fl"(6r,c?|M,d?) 

= jr(6riM,cr,dr)+H(criM,d?) 

< H(b™\M, ci l ) + (c?|M, d?) 

< 3ne„ + 2n5„ + 2ne„ + n<5„ = 5ne„ + 3nS n , 

where the last inequality invokes (16) and (14). Notice that M is independent with {b",d™}, so 

iJ(6«|d") = H(Vt\M, d?) < 5ne n + 3n<5„. (17) 

Now we bound the entropy of 6". Again consider the joint entropy, 

H(M, 6?, c") = H (c? |M, b") + ff(M|bi l ) + Jf(6J) 

= (6JIM, c") + fl"(M|c?) + £f(c") > (X + l)n - ne n - n5 n , 

where the last inequality holds because of (9), the secrecy condition ff(M|c") > Kn — n5 n , and £Z"(b™|M, c") > 0. 
So by (15) and because H(M\b'1) = Kn, we have 

H(V[) >(K + l)n - ne„ - ntf n - H(c™\M, b?) - (M |6?) > n - 3ne„ - 2n<S„. (18) 

Finally, by (17) and (18), 

> - H ( b i\ d i) >n- Sne n - 5nS n , 

The above argument extends to all other paths naturally (by renumbering the notations accordingly), so 

J(b"; d?) > n - 8ne n - 5n8 n , Vi = 1, A". 

Therefore Vi = 1,...,K, by the channel coding theorem, if we employ an outer code of length n by encoding b™ 
as a supersymbol, then there exists an inner code that achieves a rate of n — 8ne n — 8n5 n from to 7$, and so 
the overall rate is 

n - 8ne n - 5n<S„ 

iti > >• 1 as I! — >• oo. 

n 

Because Bi can be viewed as a virtual source of Si, so Vi = 1, K, the unicast from node Si to Tj of rate 1 is 
feasible. 

"<S=". The secrecy capacity is upper bounded by K due to the min cut from S to D. And secrecy rate K is 
achieved by the scheme described in Figure 2, i.e., let cfi) be the probability of error for the unicast from Si to 
Tj, then the probability of error from S to D is upper bounded by Ke* n — > as n — > oo, where e* = max^ 
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Fig. 2. A scheme to achieve secrecy rate K. V x is the local key injected by node x, with H(V X ) = 1, \/x. Mi, i = 1, K are source 
input messages, with H(Mi) = 1, i = 1, K. 



Note that the scheme achieves perfect secrecy, which in turn implies strong and weak secrecy requirements are also 
satisfied. ■ 

The above result can be easily extended to the case of zero error communication and perfect secrecy. In this 
case, we say a rate R is feasible if there exists a code with finite length n such that \S n \ = 2 nR and the probability 
of decoding error is strictly zero. Then for the secrecy communication problem in Figure 1, its zero error perfect 
secrecy capacity is K if and only if the /f-unicast for source-destination pairs {(Si, Ti), i = 1, K} of unit rate 
is feasible with zero error. The proof of this claim follows the same outline as the proof of Theorem 1, with the 
difference that all e„ and S n become strictly 0. Then (17) implies that 6" is a function of d™, and hence that it can 
be perfectly decoded from d™. 

Conversely, we note that for any given weakly secure communication problem where any one link can be 
wiretapped, we can construct a corresponding communication problem without security constraints (which can 
in turn be reduced to an equivalent multiple-unicast problem by [5]) that is feasible if and only if the secure 
communication problem is feasible. The equivalent communication problem is defined on a specialized version of 
the A-enhanced network in [6], stated here in simplified form for convenience as follows. 

Definition 1. Consider a secure communication problem on a network N represented by a directed graph Q = (V,£) 
with the collection of wiretap sets A = {{e} : e e £} comprising individual links. Let c e denote the capacity of 
link e € £ and let £ out (i) denote the set of links originating at node i € V. The A-enhanced network M(A) 
on graph Q = (V,£) is defined as follows: 

1) For each link e = G £, create an eavesdropper node v e and a node u e , replace by two links 
(i,u e ) and (u e ,j) and create a link (u e ,v e ), all of capacity c e . 

2) For each node i e V create a message node Vi and a random key node Vi. 

3) Create an overall key node vl- 
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4) For each ieV, create a set Hi of links from node Vi to all of the nodes in {i} U {v e : e £ £}, and a set 
Hi of links from node Vi to nodes i and vl, all of which have capacity 

C-i ^ ^ c e . 

e££„,a(i) 

5) For each link e £ £, create a link (vL,v e ) of capacity 

e'eS 

6) V = V U {vi : i £ V} U {v^ : i £ V} U {u e , v e : e £ £} U {w L }- 

7) £ = \Jiev( H i u ^) u {i^ue), (u e ,j), {u e ,v e ) : e = e £} U {(wi,« e ) : e € £}. 

The communication requirements in the A-enhanced network are as follows. For each message that originates 
at a node i in the original secure communication problem, in the A-enhanced network, the message originates 
instead at the corresponding message node Vi and is demanded by the same destination nodes as in the original 
problem. In addition, the communication problem on the A-enhanced network also requires a random key message 
Li S Li = {1, . . . , 2 nCi } to be delivered from each random key node Vi to all eavesdropper nodes {v e : e £ £}. 
Intuitively, if the communication problem on the A-enhanced network is solved, then it implies that the information 
observed by the eavesdropper is independent with the input message in the secure communication problem, and 
hence the secrecy conditions are satisfied. Details are given in [6]. 
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